var-201409-1154
Vulnerability from variot

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277. GNU Bash 4.3 and earlier contains a command injection vulnerability that may allow remote code execution. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

This vulnerability allows users that have been granted access to a shell script to escalate privilege and execute unrestricted commands at the same security level as the Bash script. Customers who need to upgrade the firmware of their Superdome X or HP Converged System 900 for SAP HANA should contact HP Technical Support to obtain the firmware or plan to schedule an onsite visit with an HP Services field service professional. Patch and maintain Lightweight Directory Access Protocol (LDAP) and web servers. Use virus scanners, intrusion detection/prevention systems (IDS/IPS), and vulnerability scanners regularly. ============================================================================ Ubuntu Security Notice USN-2380-1 October 09, 2014

bash vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS
  • Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in Bash.

Software Description: - bash: GNU Bourne Again SHell

Details:

Michal Zalewski discovered that Bash incorrectly handled parsing certain function definitions. If an attacker were able to create an environment variable containing a function definition with a very specific name, these issues could possibly be used to bypass certain environment restrictions and execute arbitrary code. (CVE-2014-6277, CVE-2014-6278)

Please note that the previous Bash security update, USN-2364-1, includes a hardening measure that prevents these issues from being used in a Shellshock attack.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 LTS: bash 4.3-7ubuntu1.5

Ubuntu 12.04 LTS: bash 4.2-2ubuntu2.6

Ubuntu 10.04 LTS: bash 4.1-2ubuntu3.5

In general, a standard system update will make all the necessary changes.

References: http://www.ubuntu.com/usn/usn-2380-1 CVE-2014-6277, CVE-2014-6278

Package Information: https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.5 https://launchpad.net/ubuntu/+source/bash/4.2-2ubuntu2.6 https://launchpad.net/ubuntu/+source/bash/4.1-2ubuntu3.5 . -----BEGIN PGP SIGNED MESSAGE-----

CA20141001-01: Security Notice for Bash Shellshock Vulnerability

Issued: October 01, 2014 Updated: October 03, 2014

CA Technologies is investigating multiple GNU Bash vulnerabilities, referred to as the "Shellshock" vulnerabilities, which were publicly disclosed on September 24-27, 2014. CVE identifiers CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, and CVE-2014-6278 have been assigned to these vulnerabilities.

The CA Technologies Enterprise Information Security team has led a global effort to identify and remediate systems and products discovered with these vulnerabilities. We continue to patch our systems as fixes become available, and we are providing fixes for affected CA Technologies products.

CA Technologies continues to aggressively scan our environments (including servers, networks, external facing applications, and SaaS environments) to proactively monitor, identify, and remediate any vulnerability when necessary.

Risk Rating

High

Platform

AIX Android (not vulnerable, unless rooted) Apple iOS (not vulnerable unless jailbroken) Linux Mac OS X Solaris Windows (not vulnerable unless Cygwin or similar ported Linux tools with Bash shell are installed) Other UNIX/BSD based systems if Bash is installed Any other OS or JeOS that utilizes Bash

Affected Products

The following products have been identified as potentially vulnerable, and we have made fixes available for all of these products.

CA API Management (Linux appliance only)

CA Application Performance Management (TIM is the only affected APM component)

CA Application Performance Management Cloud Monitor

CA Customer Experience Manager (CEM) Transaction Impact Monitor (TIM)

CA Layer 7 products (API Gateway, Mobile Access Gateway, API Management Portal)

CA User Activity Reporting Module (Enterprise Log Manager)

Note: This security notice will be updated if other CA Technologies products are determined to be vulnerable.

In most cases, the Bash vulnerabilities will need to be patched by OS vendors. Exceptions may include CA Technologies appliances, and software products that include Linux, UNIX or Mac OS X based operating systems (that include Bash).

Affected Components

CentOS Cygwin GNU Bash Red Hat Enterprise Linux SUSE Linux

Non-Affected Products

IMPORTANT NOTE: This listing includes only a small subset of the unaffected CA Technologies products. We're including unaffected products that customers have already inquired about. While the following CA Technologies products are not directly affected by the Bash vulnerabilities, the underlying operating systems that CA Technologies software is installed on may be vulnerable. We strongly encourage our customers to follow the recommendations provided by their vendors for all operating systems they utilize.

All CA SaaS / On Demand products were either not vulnerable or have already been patched.

CA AHS / PaymentMinder - AHS App is not vulnerable. The AHS app does not execute CGI scripts, or spawn or execute shell commands from within the app. AHS infrastructure already patched.

CA Asset Portfolio Management

CA AuthMinder (Arcot WebFort)

CA AuthMinder for Business Users

CA AuthMinder for Consumers

CA AutoSys products - We use the bash shell that comes with the operating system and the customer is responsible for patching their OS. Additionally, the agents themselves do not distribute any scripts that use bash.

CA Clarity On Demand

CA CloudMinder - CloudMinder does not include the Bash Shell in BoM, or use it, but because we are deployed on RHEL, customers may be indirectly affected. Customers using RHEL should apply patches provided by Red Hat.

CA Console Management for OpenVMS - Our OpenVMS products do not bundle bash, and they do not supply bash scripts; we use nothing but the native DCL CLI.

CA ControlMinder

CA DataMinder (formerly DLP) products – Software and appliance confirmed not vulnerable. Note: Linux Agents shipped, but no public SSH or Web apps are used in these agents. Customers should patch bash shell on any Linux server with DataMinder agents. DataMinder agents should continue to function normally.

CA Digital Payments SaaS (previously patched)

CA Directory

CA eCommerce SaaS / On Demand (previously patched)

CA Endevor Software Change Manager

CA Federation (formerly SiteMinder Federation)

CA GovernanceMinder

CA IdentityMinder

CA Infrastructure Management

CA JCLCheck

CA Job Management for OpenVMS - Our OpenVMS products do not bundle bash, and they do not supply bash scripts; we use nothing but the native DCL CLI.

CA NetQoS GigaStor Observer Expert

CA Network Flow Analysis

CA Performance Management for OpenVMS - Our OpenVMS products do not bundle bash, and they do not supply bash scripts; we use nothing but the native DCL CLI.

CA RiskMinder

CA Service Desk Manager

CA Service Operations Insight (SOI)

CA SiteMinder

CA SOLVE:Access

CA Spectrum for Linux - Not vulnerable. Be sure to apply bash fixes from your underlying operating system vendor.

CA Strong Authentication

CA System Watchdog for OpenVMS - Our OpenVMS products do not bundle bash, and they do not supply bash scripts; we use nothing but the native DCL CLI.

CA Top Secret

CA Universal Job Management Agent for OpenVMS - Our OpenVMS products do not bundle bash, and they do not supply bash scripts; we use nothing but the native DCL CLI.

CA Virtual Assurance for Infrastructure Managers (VAIM)

Solution

CA Technologies has issued the following fixes to address the vulnerabilities.

CA API Management: Patches for Linux appliance are available through CA Support to customers of Gateway (applicable for all versions – 6.1.5, 6.2, 7.0, 7.1, 8.0, 8.1, 8.1.1, 8.1.02).

CA Application Performance Management: KB article for APM TIM has been published. APM TIM is the only part of APM that was affected. Refer to TEC618037.

CA Application Performance Management Cloud Monitor: New images are available for subscribers. Download the latest OPMS version 8.2.1.5. For assistance, contact CA Support.

CA Customer Experience Manager (CEM) Transaction Impact Monitor (TIM): Very low risk. 9.6 is not affected. 9.5 Installation uses Bash. We do not use Bash at all for the CEM operating system that we have shipped in the past. This means that customers who patch the OS will not impact the ability of the CEM TIMsoft from operating. However prior to version 9.6, the TIM installation script does use the bash shell. See new KB article TEC618037 for additional information.

CA Layer 7 (API Gateway, Mobile Access Gateway, API Management Portal): Fixes for all Bash vulnerabilities and a security bulletin are available on the Layer 7 Support website.

CA User Activity Reporting Module (Enterprise Log Manager): All 12.5 and 12.6 GA versions are potentially affected. Patches provided on 2014-09-30. To get the patch, use the OS update functionality to get the latest R12.6 SP1 subscription update. Note that you can update R12.5 SPx with the R12.6 SP1 OS update. For assistance, contact CA Support.

Workaround

None

To help mitigate the risk, we do strongly encourage all customers to follow patch management best practices, and in particular for operating systems affected by the Bash Shellshock vulnerabilities.

References

CVE-2014-6271 - Bash environment variable command injection CVE-2014-7169 - Bash environment variable incomplete fix for CVE-2014-6271 CVE-2014-7186 - Bash parser redir_stack memory corruption CVE-2014-7187 - Bash nested flow control constructs off-by-one CVE-2014-6277 - Bash untrusted pointer use uninitialized memory CVE-2014-6278 - Bash environment variable command injection

CA20141001-01: Security Notice for Bash Shellshock Vulnerability https://support.ca.com/irj/portal/anonymous/phpsbpldgpg

Change History

v1.0: 2014-10-01, Initial Release v1.1: 2014-10-02, Added AuthMinder, Strong Authentication, VAIM, Clarity OD, All SaaS/OD products to list of Non-Affected Products. v1.2: 2014-10-03, Added RiskMinder to Non-Affected Products. Updated UARM solution info.

If additional information is required, please contact CA Technologies Support at https://support.ca.com.

If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team at vuln@ca.com. PGP key: support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782

Security Notices https://support.ca.com/irj/portal/anonymous/phpsbpldgpg

Regards, Ken Williams Director, Product Vulnerability Response Team CA Technologies | One CA Plaza | Islandia, NY 11749 | www.ca.com Ken.Williams@ca.com | vuln@ca.com

Copyright © 2014 CA. All Rights Reserved. One CA Plaza, Islandia, N.Y. 11749. All other trademarks, trade names, service marks, and logos referenced herein belong to their respective companies.

-----BEGIN PGP SIGNATURE----- Version: Encryption Desktop 10.3.2 (Build 15238) Charset: utf-8

wsBVAwUBVDK+PZI1FvIeMomJAQFl/Af/TqrSE/h4r3gs9PwrWKdt21PCRI3za9Lx M5ZyTdVDIQ9ybgPkLqsovNRPgVqd7zwDHsx0rzvF5Y82uO+vQ63BuEV2GnczAax/ EiAW4WVxUgWG+lAowGV55Of8ruv/gOiAWTjFhkqpsyVg96ZMw2HLG62IwZL1j0qa oLCu0y3VrGvqH0g2hi75QwHAjNCdlEsD4onUqTCc9cRTdLwFCZrUQ8KTrqIL7LK5 Uo5T9C1UeAyNTo3KiJ/zw3BCOTkpl99dmg3NW0onU/1r1CXdlyS7opLB+GJ+xGwP xRQdUsOIhzfRzx7bsao2D43IhDnzJBBFJHdeMPo18WBTfJ7aUgBwGQ== =B62b -----END PGP SIGNATURE----- . Note: All versions of HP Thin Pro and HP Smart Zero Core operating systems prior to version 5.1.0 are affected by these vulnerabilities. Following is a complete list of affected operating systems and Hardware Platforms Affected.

Product Affected Product Versions Patch Status

HP ThinPro and HP Smart Zero Core (X86) v5.1.0 and above No update required; the Bash shell patch is incorporated into the base image.

Note: If you participated in the ThinPro 5.1.0 beta program then upgrade to the release version as soon as it becomes available.

HP ThinPro and HP Smart Zero Core (x86) v5.0.x A component update is currently available through Easy Update as: SecurityUpdate-Shellshock-2.0-all-5.0-x86.xar .

The update can be also downloaded directly from HP as part of softpaq sp69382 at the following address: ftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe

HP ThinPro and HP Smart Zero Core (x86) v4.4.x A component update is currently available through Easy Update as: SecurityUpdate-Shellshock-2.0-all-4.4-x86.xar .

The update can be also downloaded directly from HP as part of softpaq sp69382 at the following address: ftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe

HP ThinPro and HP Smart Zero Core (ARM) v4.4.x A component update is currently available through Easy Update as: SecurityUpdate-Shellshock-2.0-all-4.4-arm.xar .

The update can be also downloaded directly from HP as part of softpaq sp69382 at the following address: ftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe

HP ThinPro and HP Smart Zero Core (X86) v4.1, v4.2, and v4.3 A component update is currently available through Easy Update as: SecurityUpdate-Shellshock-2.0-all-4.1-4.2-4.3-x86.xar .

The update can be also downloaded directly from HP as part of softpaq sp69382 at the following address: ftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe

HP ThinPro and HP Smart Zero Core (ARM) v4.1, v4.2, and v4.3 A component update is currently available through Easy Update as: SecurityUpdate-Shellshock-2.0-all-4.1-4.2-4.3-arm.xar .

The update can be also downloaded directly from HP as part of softpaq sp69382 at the following address: ftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe

HP ThinPro and HP Smart Zero Core (X86) v3.1, v3.2, and v3.3 Download softpaq sp69382 from: ftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe which contains an update package as: bash_4.1-3+deb6u2_i386.deb .

HP ThinPro and HP Smart Zero Core (ARM) v3.1, v3.2, and v3.3 Download softpaq sp69382 from: ftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe which contains an update package as: bash_4.1-3+deb6u2_armel.deb .

HP StoreEver ESL E-series Tape Library

- Disable DHCP and only use static IP addressing.

HP Virtual Library System (VLS)

- Disable DHCP and only use static IP addressing. No other firmware

stream updates are planned beyond the NX-OS 5.x and 6.x versions listed below for the MDS products. This software versions 6.2(9a) has included the fixes for the vulnerability in HP StoreFabric C-series MDS switches which currently supporting NX-OS 6.X releases. This software version 5.2(8e) has included the fix for the vulnerability in HP C-series MDS switches which currently supporting NX-OS 5.X releases. All MDS and Nexus 5K switches can function in this configuration. Access is available through the console port. This bulletin will be revised when the update is available.

MITIGATION INFORMATION

HP recommends the following steps to reduce the risk of this

vulnerability:

  - Place the HP StoreFabric H-series switch and other data center

critical infrastructure behind a firewall to disallow access from the Internet. - Change all HP StoreFabric switch default account passwords, including the root passwords, from the default factory passwords. - Examine the list of accounts, including ones on the switch and those existing on remote authentication servers such as RADIUS, LDAP, and TACAS+, to ensure only necessary personnel can gain access to HP StoreFabric H-series switches. Delete guest accounts and temporary accounts created for one-time usage needs. - To avoid possible exploit through the embedded web GUI, QuickTools, disable the web server with the following procedure:

    NOTE: After completing this procedure, the user will not be able to

manage the switch using QuickTools. Login to the Command Line Interface (CLI). Execute the "admin start" command to enter into an admin session. Execute the "set setup services" command and change setting for EmbeddedGUIEnabled to "False".

HISTORY Version:1 (rev.1) - 11 November 2014 Initial release

Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04512907

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c04512907 Version: 1

HPSBMU03217 rev.1 - HP Vertica Analytics Platform running Bash Shell, Remote Code Execution

NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Release Date: 2014-12-16 Last Updated: 2014-12-16

Potential Security Impact: Remote code execution

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP Vertica.

References:

CVE-2014-6271 CVE-2014-6277 CVE-2014-6278 CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 SSRT101827

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

HP Vertica AMI's and Virtual Machines prior to v7.1.1-0.

CVSS 2.0 Base Metrics

Reference Base Vector Base Score CVE-2014-6271 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2104-6277 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2104-6278 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2014-7169 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2014-7186 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2014-7187 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002

RESOLUTION

We recommend installing Vertica v7.1.1-0 or subsequent, or manually installing a new version of Bash, such as Bash43-027.

HP has released the following updates to resolve this vulnerability for HP Vertica products.

Update to the latest VM image available at: https://my.vertica.com

For customers using the AMI version HP Vertica Analytics platform, please install the latest image available at Amazon.

Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. To get the security-alert PGP key, please send an e-mail message as follows: To: security-alert@hp.com Subject: get key

Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email: http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG &jumpid=in_SC-GEN__driverITRC&topiccode=ITRC On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches - check ALL categories for which alerts are required and continue. Under Step2: your ITRC operating systems - verify your operating system selections are checked and save.

To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php Log in on the web page: Subscriber's choice for Business: sign-in. On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.

To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do

  • The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title: GN = HP General SW MA = HP Management Agents MI = Misc. 3rd Party SW

MP = HP MPE/iX NS = HP NonStop Servers OV = HP OpenVMS

PI = HP Printing & Imaging ST = HP Storage SW TL = HP Trusted Linux

TU = HP Tru64 UNIX UX = HP-UX VV = HP VirtualVault

System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.

"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."

Copyright 2014 Hewlett-Packard Development Company, L.P.

Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice.

Note: HP and the switch vendor recommend running an active version of Fabric OS (FOS) listed on the HP Single Point of Connectivity Knowledge (SPOCK) website ( http://h20272.www2.hp.com/ ) and applying the work-around information provided in the MITIGATION INFORMATION section below to protect HP StoreFabric B-series switches from this vulnerability. - Utilize FOS password policy management to strengthen the complexity, age, and history requirements of switch account passwords

Show details on source website


{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201409-1154",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "gnu",
        "version": "4.2"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "1.14.4"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "1.14.3"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "3.0"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "2.03"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "3.2.48"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "1.14.1"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "2.01"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "1.14.5"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "3.0.16"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "2.01.1"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "1.14.2"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "4.3"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "4.1"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "1.14.7"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "1.14.6"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "1.14.0"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "4.0"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "2.04"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "3.2"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "3.1"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "2.0"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "2.02"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "2.02.1"
      },
      {
        "model": "bash",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "2.05"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "apple",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "avaya",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "barracuda",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "blue coat",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "centos",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "check point",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "cygwin",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "d link",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "debian gnu linux",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "dell computer",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "extreme",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "f5",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "fedora",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "fireeye",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "fortinet",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "gnu bash",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "gentoo linux",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "hewlett packard",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "ibm",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "juniper",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "mageia",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "mcafee",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "monroe",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "nec",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "niksun",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "novell",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "oracle",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "palo alto",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "qnap security",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "red hat",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "suse linux",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "slackware linux",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "sophos",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "trend micro",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "ubuntu",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "vmware",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "xirrus",
        "version": null
      },
      {
        "model": "workcentre",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "xerox",
        "version": "7245"
      },
      {
        "model": "workcentre",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "xerox",
        "version": "7242"
      },
      {
        "model": "workcentre",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "xerox",
        "version": "7238"
      },
      {
        "model": "workcentre",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "xerox",
        "version": "7235"
      },
      {
        "model": "workcentre",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "xerox",
        "version": "7232"
      },
      {
        "model": "workcentre",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "xerox",
        "version": "7228"
      },
      {
        "model": "phaser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "xerox",
        "version": "78000"
      },
      {
        "model": "phaser",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "xerox",
        "version": "67000"
      },
      {
        "model": "colorqube",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "xerox",
        "version": "9393"
      },
      {
        "model": "colorqube",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "xerox",
        "version": "9303"
      },
      {
        "model": "colorqube",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "xerox",
        "version": "9302"
      },
      {
        "model": "colorqube",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "xerox",
        "version": "9301"
      },
      {
        "model": "linux lts i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "12.04"
      },
      {
        "model": "linux lts amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "12.04"
      },
      {
        "model": "linux sparc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "linux powerpc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "linux i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "linux arm",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "linux amd64",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "10.04"
      },
      {
        "model": "solaris",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sun",
        "version": "11"
      },
      {
        "model": "vm virtualbox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.2"
      },
      {
        "model": "vm virtualbox",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.1"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "5"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.2"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "5"
      },
      {
        "model": "email gateway patch",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mcafee",
        "version": "7.01"
      },
      {
        "model": "email gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mcafee",
        "version": "7.0"
      },
      {
        "model": "email gateway hotfix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mcafee",
        "version": "6.7.22"
      },
      {
        "model": "email gateway hotfix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "mcafee",
        "version": "6.7.21"
      },
      {
        "model": "ds8000",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "0"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "6.1"
      },
      {
        "model": "aix",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "5.3"
      },
      {
        "model": "insight control",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "0"
      },
      {
        "model": "linux",
        "scope": null,
        "trust": 0.3,
        "vendor": "gentoo",
        "version": null
      },
      {
        "model": "wide area application services",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "unified ip phone",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "unified contact center express",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "network analysis module",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "mds",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "gss 4492r global site selector",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "emergency responder",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "1.1"
      },
      {
        "model": "digital media manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "5.0"
      },
      {
        "model": "digital media manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "show and share",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "5(2)"
      },
      {
        "model": "ip deskphone",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "96x16.2"
      },
      {
        "model": "ip deskphone",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "96x16"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#252743"
      },
      {
        "db": "BID",
        "id": "70166"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-6278"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "HP",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "128764"
      },
      {
        "db": "PACKETSTORM",
        "id": "130988"
      },
      {
        "db": "PACKETSTORM",
        "id": "129068"
      },
      {
        "db": "PACKETSTORM",
        "id": "129070"
      },
      {
        "db": "PACKETSTORM",
        "id": "128864"
      },
      {
        "db": "PACKETSTORM",
        "id": "128752"
      },
      {
        "db": "PACKETSTORM",
        "id": "129438"
      },
      {
        "db": "PACKETSTORM",
        "id": "129095"
      },
      {
        "db": "PACKETSTORM",
        "id": "129073"
      },
      {
        "db": "PACKETSTORM",
        "id": "129617"
      },
      {
        "db": "PACKETSTORM",
        "id": "128760"
      }
    ],
    "trust": 1.1
  },
  "cve": "CVE-2014-6278",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2014-6278",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.1,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2014-6278",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2014-6278",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-6278"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-6278"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277. GNU Bash 4.3 and earlier contains a command injection vulnerability that may allow remote code execution. \nAn attacker can exploit this issue to execute arbitrary code within the  context of the affected application. Failed exploit  attempts will  result in a denial-of-service  condition. \n\nThis vulnerability allows users that have been granted access to a shell\nscript to escalate privilege and execute unrestricted commands at the same\nsecurity level as the Bash script. Customers who\nneed to upgrade the firmware of their Superdome X or HP Converged System 900\nfor SAP HANA should contact HP Technical Support to obtain the firmware or\nplan to schedule an onsite visit with an HP Services field service\nprofessional. \nPatch and maintain Lightweight Directory Access Protocol (LDAP) and web\nservers. \nUse virus scanners, intrusion detection/prevention systems (IDS/IPS), and\nvulnerability scanners regularly. ============================================================================\nUbuntu Security Notice USN-2380-1\nOctober 09, 2014\n\nbash vulnerabilities\n============================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 14.04 LTS\n- Ubuntu 12.04 LTS\n- Ubuntu 10.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in Bash. \n\nSoftware Description:\n- bash: GNU Bourne Again SHell\n\nDetails:\n\nMichal Zalewski discovered that Bash incorrectly handled parsing certain\nfunction definitions. If an attacker were able to create an environment\nvariable containing a function definition with a very specific name, these\nissues could possibly be used to bypass certain environment restrictions\nand execute arbitrary code. (CVE-2014-6277, CVE-2014-6278)\n\nPlease note that the previous Bash security update, USN-2364-1, includes\na hardening measure that prevents these issues from being used in a\nShellshock attack. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 14.04 LTS:\n  bash                            4.3-7ubuntu1.5\n\nUbuntu 12.04 LTS:\n  bash                            4.2-2ubuntu2.6\n\nUbuntu 10.04 LTS:\n  bash                            4.1-2ubuntu3.5\n\nIn general, a standard system update will make all the necessary changes. \n\nReferences:\n  http://www.ubuntu.com/usn/usn-2380-1\n  CVE-2014-6277, CVE-2014-6278\n\nPackage Information:\n  https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.5\n  https://launchpad.net/ubuntu/+source/bash/4.2-2ubuntu2.6\n  https://launchpad.net/ubuntu/+source/bash/4.1-2ubuntu3.5\n. \n-----BEGIN PGP SIGNED MESSAGE-----\n\nCA20141001-01: Security Notice for Bash Shellshock Vulnerability\n\n\nIssued: October 01, 2014\nUpdated: October 03, 2014\n\n\nCA Technologies is investigating multiple GNU Bash vulnerabilities, \nreferred to as the \"Shellshock\" vulnerabilities, which were publicly \ndisclosed on September 24-27, 2014. CVE identifiers CVE-2014-6271, \nCVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, and \nCVE-2014-6278 have been assigned to these vulnerabilities. \n\nThe CA Technologies Enterprise Information Security team has led a \nglobal effort to identify and remediate systems and products discovered \nwith these vulnerabilities. We continue to patch our systems as fixes \nbecome available, and we are providing fixes for affected CA \nTechnologies products. \n\nCA Technologies continues to aggressively scan our environments \n(including servers, networks, external facing applications, and SaaS \nenvironments) to proactively monitor, identify, and remediate any \nvulnerability when necessary. \n\n\nRisk Rating\n\nHigh\n\n\nPlatform\n\nAIX\nAndroid (not vulnerable, unless rooted)\nApple iOS (not vulnerable unless jailbroken)\nLinux\nMac OS X\nSolaris\nWindows (not vulnerable unless Cygwin or similar ported Linux tools \n   with Bash shell are installed)\nOther UNIX/BSD based systems if Bash is installed\nAny other OS or JeOS that utilizes Bash\n\n\nAffected Products\n\nThe following products have been identified as potentially vulnerable, \nand we have made fixes available for all of these products. \n\nCA API Management (Linux appliance only)\n\nCA Application Performance Management (TIM is the only affected APM \n   component)\n\nCA Application Performance Management Cloud Monitor\n\nCA Customer Experience Manager (CEM) Transaction Impact Monitor (TIM)\n\nCA Layer 7 products (API Gateway, Mobile Access Gateway, API Management \n   Portal)\n\nCA User Activity Reporting Module (Enterprise Log Manager)\n\nNote: This security notice will be updated if other CA Technologies \nproducts are determined to be vulnerable. \n\nIn most cases, the Bash vulnerabilities will need to be patched by OS \nvendors. Exceptions may include CA Technologies appliances, and \nsoftware products that include Linux, UNIX or Mac OS X based operating \nsystems (that include Bash). \n\n\nAffected Components\n\nCentOS\nCygwin\nGNU Bash\nRed Hat Enterprise Linux\nSUSE Linux\n\n\nNon-Affected Products\n\nIMPORTANT NOTE: This listing includes only a small subset of the \nunaffected CA Technologies products. We\u0027re including unaffected \nproducts that customers have already inquired about. While the \nfollowing CA Technologies products are not directly affected by the \nBash vulnerabilities, the underlying operating systems that CA \nTechnologies software is installed on may be vulnerable. We strongly \nencourage our customers to follow the recommendations provided by their \nvendors for all operating systems they utilize. \n\nAll CA SaaS / On Demand products were either not vulnerable or have \nalready been patched. \n\nCA AHS / PaymentMinder - AHS App is not vulnerable. The AHS app does \nnot execute CGI scripts, or spawn or execute shell commands from within \nthe app. AHS infrastructure already patched. \n\nCA Asset Portfolio Management\n\nCA AuthMinder (Arcot WebFort)\n\nCA AuthMinder for Business Users\n\nCA AuthMinder for Consumers\n\nCA AutoSys products - We use the bash shell that comes with the \noperating system and the customer is responsible for patching their OS. \nAdditionally, the agents themselves do not distribute any scripts that \nuse bash. \n\nCA Clarity On Demand\n\nCA CloudMinder - CloudMinder does not include the Bash Shell in BoM, or \nuse it, but because we are deployed on RHEL, customers may be \nindirectly affected. Customers using RHEL should apply patches provided \nby Red Hat. \n\nCA Console Management for OpenVMS - Our OpenVMS products do not bundle \nbash, and they do not supply bash scripts; we use nothing but the \nnative DCL CLI. \n\nCA ControlMinder\n\nCA DataMinder (formerly DLP) products \u2013 Software and appliance \nconfirmed not vulnerable. Note: Linux Agents shipped, but no public SSH \nor Web apps are used in these agents. Customers should patch bash shell \non any Linux server with DataMinder agents. DataMinder agents should \ncontinue to function normally. \n\nCA Digital Payments SaaS (previously patched)\n\nCA Directory\n\nCA eCommerce SaaS / On Demand (previously patched)\n\nCA Endevor Software Change Manager\n\nCA Federation (formerly SiteMinder Federation)\n\nCA GovernanceMinder\n\nCA IdentityMinder\n\nCA Infrastructure Management\n\nCA JCLCheck\n\nCA Job Management for OpenVMS - Our OpenVMS products do not bundle \nbash, and they do not supply bash scripts; we use nothing but the \nnative DCL CLI. \n\nCA NetQoS GigaStor Observer Expert\n\nCA Network Flow Analysis\n\nCA Performance Management for OpenVMS - Our OpenVMS products do not \nbundle bash, and they do not supply bash scripts; we use nothing but \nthe native DCL CLI. \n\nCA RiskMinder\n\nCA Service Desk Manager\n\nCA Service Operations Insight (SOI)\n\nCA SiteMinder\n\nCA SOLVE:Access\n\nCA Spectrum for Linux - Not vulnerable. Be sure to apply bash fixes \nfrom your underlying operating system vendor. \n\nCA Strong Authentication\n\nCA System Watchdog for OpenVMS - Our OpenVMS products do not bundle \nbash, and they do not supply bash scripts; we use nothing but the \nnative DCL CLI. \n\nCA Top Secret\n\nCA Universal Job Management Agent for OpenVMS - Our OpenVMS products do \nnot bundle bash, and they do not supply bash scripts; we use nothing \nbut the native DCL CLI. \n\nCA Virtual Assurance for Infrastructure Managers (VAIM)\n\n\nSolution\n\nCA Technologies has issued the following fixes to address the \nvulnerabilities. \n\nCA API Management:\nPatches for Linux appliance are available through CA Support to \ncustomers of Gateway (applicable for all versions \u2013 6.1.5, 6.2, 7.0, \n7.1, 8.0, 8.1, 8.1.1, 8.1.02). \n\nCA Application Performance Management:\nKB article for APM TIM has been published. APM TIM is the only part of \nAPM that was affected. Refer to TEC618037. \n\nCA Application Performance Management Cloud Monitor:\nNew images are available for subscribers. Download the latest OPMS \nversion 8.2.1.5. For assistance, contact CA Support. \n\nCA Customer Experience Manager (CEM) Transaction Impact Monitor (TIM):\nVery low risk. 9.6 is not affected. 9.5 Installation uses Bash. We do \nnot use Bash at all for the CEM operating system that we have shipped \nin the past. This means that customers who patch the OS will not impact \nthe ability of the CEM TIMsoft from operating. However prior to version \n9.6, the TIM installation script does use the bash shell. See new KB \narticle TEC618037 for additional information. \n\nCA Layer 7 (API Gateway, Mobile Access Gateway, API Management Portal):\nFixes for all Bash vulnerabilities and a security bulletin are available \non the Layer 7 Support website. \n\nCA User Activity Reporting Module (Enterprise Log Manager):\nAll 12.5 and 12.6 GA versions are potentially affected. Patches \nprovided on 2014-09-30. To get the patch, use the OS update \nfunctionality to get the latest R12.6 SP1 subscription update. Note \nthat you can update R12.5 SPx with the R12.6 SP1 OS update. For \nassistance, contact CA Support. \n\n\nWorkaround\n\nNone\n\nTo help mitigate the risk, we do strongly encourage all customers to \nfollow patch management best practices, and in particular for operating \nsystems affected by the Bash Shellshock vulnerabilities. \n\n\nReferences\n\nCVE-2014-6271 - Bash environment variable command injection\nCVE-2014-7169 - Bash environment variable incomplete fix for CVE-2014-6271\nCVE-2014-7186 - Bash parser redir_stack memory corruption\nCVE-2014-7187 - Bash nested flow control constructs off-by-one\nCVE-2014-6277 - Bash untrusted pointer use uninitialized memory\nCVE-2014-6278 - Bash environment variable command injection\n\nCA20141001-01: Security Notice for Bash Shellshock Vulnerability\nhttps://support.ca.com/irj/portal/anonymous/phpsbpldgpg\n\n\nChange History\n\nv1.0: 2014-10-01, Initial Release\nv1.1: 2014-10-02, Added AuthMinder, Strong Authentication, VAIM, \n      Clarity OD, All SaaS/OD products to list of Non-Affected Products. \nv1.2: 2014-10-03, Added RiskMinder to Non-Affected Products. Updated \n      UARM solution info. \n\n\nIf additional information is required, please contact CA Technologies \nSupport at https://support.ca.com. \n\nIf you discover a vulnerability in CA Technologies products, please \nreport your findings to the CA Technologies Product Vulnerability \nResponse Team at vuln@ca.com. \nPGP key:\nsupport.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782\n\nSecurity Notices\nhttps://support.ca.com/irj/portal/anonymous/phpsbpldgpg\n\n\nRegards,\nKen Williams\nDirector, Product Vulnerability Response Team\nCA Technologies | One CA Plaza | Islandia, NY 11749 | www.ca.com\nKen.Williams@ca.com | vuln@ca.com\n\n\nCopyright \u00a9 2014 CA. All Rights Reserved. One CA Plaza, Islandia, N.Y. \n11749. All other trademarks, trade names, service marks, and logos \nreferenced herein belong to their respective companies. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: Encryption Desktop 10.3.2 (Build 15238)\nCharset: utf-8\n\nwsBVAwUBVDK+PZI1FvIeMomJAQFl/Af/TqrSE/h4r3gs9PwrWKdt21PCRI3za9Lx\nM5ZyTdVDIQ9ybgPkLqsovNRPgVqd7zwDHsx0rzvF5Y82uO+vQ63BuEV2GnczAax/\nEiAW4WVxUgWG+lAowGV55Of8ruv/gOiAWTjFhkqpsyVg96ZMw2HLG62IwZL1j0qa\noLCu0y3VrGvqH0g2hi75QwHAjNCdlEsD4onUqTCc9cRTdLwFCZrUQ8KTrqIL7LK5\nUo5T9C1UeAyNTo3KiJ/zw3BCOTkpl99dmg3NW0onU/1r1CXdlyS7opLB+GJ+xGwP\nxRQdUsOIhzfRzx7bsao2D43IhDnzJBBFJHdeMPo18WBTfJ7aUgBwGQ==\n=B62b\n-----END PGP SIGNATURE-----\n. \nNote: All versions of HP Thin Pro and HP Smart Zero Core operating systems\nprior to version 5.1.0 are affected by these vulnerabilities. Following is a\ncomplete list of affected operating systems and Hardware Platforms Affected. \n\nProduct Affected\n Product Versions\n Patch Status\n\nHP ThinPro and HP Smart Zero Core (X86)\n v5.1.0 and above\n No update required; the Bash shell patch is incorporated into the base\nimage. \n\nNote: If you participated in the ThinPro 5.1.0 beta program then upgrade to\nthe release version as soon as it becomes available. \n\nHP ThinPro and HP Smart Zero Core (x86)\n v5.0.x\n A component update is currently available through Easy Update as:\nSecurityUpdate-Shellshock-2.0-all-5.0-x86.xar . \n\nThe update can be also downloaded directly from HP as part of softpaq sp69382\nat the following address:\nftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe\n\nHP ThinPro and HP Smart Zero Core (x86)\n v4.4.x\n A component update is currently available through Easy Update as:\nSecurityUpdate-Shellshock-2.0-all-4.4-x86.xar . \n\nThe update can be also downloaded directly from HP as part of softpaq sp69382\nat the following address:\nftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe\n\nHP ThinPro and HP Smart Zero Core (ARM)\n v4.4.x\n A component update is currently available through Easy Update as:\nSecurityUpdate-Shellshock-2.0-all-4.4-arm.xar . \n\nThe update can be also downloaded directly from HP as part of softpaq sp69382\nat the following address:\nftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe\n\nHP ThinPro and HP Smart Zero Core (X86)\n v4.1, v4.2, and v4.3\n A component update is currently available through Easy Update as:\nSecurityUpdate-Shellshock-2.0-all-4.1-4.2-4.3-x86.xar . \n\nThe update can be also downloaded directly from HP as part of softpaq sp69382\nat the following address:\nftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe\n\nHP ThinPro and HP Smart Zero Core (ARM)\n v4.1, v4.2, and v4.3\n A component update is currently available through Easy Update as:\nSecurityUpdate-Shellshock-2.0-all-4.1-4.2-4.3-arm.xar . \n\nThe update can be also downloaded directly from HP as part of softpaq sp69382\nat the following address:\nftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe\n\nHP ThinPro and HP Smart Zero Core (X86)\n v3.1, v3.2, and v3.3\n Download softpaq sp69382 from:\nftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe which contains an\nupdate package as:  bash_4.1-3+deb6u2_i386.deb . \n\nHP ThinPro and HP Smart Zero Core (ARM)\n v3.1, v3.2, and v3.3\n Download softpaq sp69382 from:\nftp://ftp.hp.com/pub/softpaq/sp69001-69500/sp69382.exe which contains an\nupdate package as:  bash_4.1-3+deb6u2_armel.deb . \n\n  HP StoreEver ESL E-series Tape Library\n\n    - Disable DHCP and only use static IP addressing. \n\n  HP Virtual Library System (VLS)\n\n    - Disable DHCP and only use static IP addressing. No other firmware\nstream updates are planned beyond the NX-OS 5.x and 6.x versions listed below\nfor the MDS products. This software versions 6.2(9a) has included the\nfixes for the vulnerability in HP StoreFabric C-series MDS switches which\ncurrently supporting NX-OS 6.X releases. This software version 5.2(8e) has included the fix\nfor the vulnerability in HP C-series MDS switches which currently supporting\nNX-OS 5.X releases. All MDS and\nNexus 5K switches can function in this configuration. Access is available\nthrough the console port. This bulletin will be revised when the\nupdate is available. \n\n  MITIGATION INFORMATION\n\n    HP recommends the following steps to reduce the risk of this\nvulnerability:\n\n      - Place the HP StoreFabric H-series switch and other data center\ncritical infrastructure behind a firewall to disallow access from the\nInternet. \n      - Change all HP StoreFabric switch default account passwords, including\nthe root passwords, from the default factory passwords. \n      - Examine the list of accounts, including ones on the switch and those\nexisting on remote authentication servers such as RADIUS, LDAP, and TACAS+,\nto ensure only necessary personnel can gain access to HP StoreFabric H-series\nswitches. Delete guest accounts and temporary accounts created for one-time\nusage needs. \n      - To avoid possible exploit through the embedded web GUI, QuickTools,\ndisable the web server with the following procedure:\n\n        NOTE: After completing this procedure, the user will not be able to\nmanage the switch using QuickTools. Login to the Command Line Interface (CLI). Execute the \"admin start\" command to enter into an admin session. Execute the \"set setup services\" command and change setting for\nEmbeddedGUIEnabled to \"False\". \n\nHISTORY\nVersion:1 (rev.1) - 11 November 2014 Initial release\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running HP software products should be applied in\naccordance with the customer\u0027s patch management policy.  For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hp.com. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nNote: the current version of the following document is available here:\nhttps://h20564.www2.hp.com/portal/site/hpsc/public/kb/\ndocDisplay?docId=emr_na-c04512907\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c04512907\nVersion: 1\n\nHPSBMU03217 rev.1 - HP Vertica Analytics Platform running Bash Shell, Remote\nCode Execution\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2014-12-16\nLast Updated: 2014-12-16\n\nPotential Security Impact: Remote code execution\n\nSource: Hewlett-Packard Company, HP Software Security Response Team\n\nVULNERABILITY SUMMARY\nA potential security vulnerability has been identified with HP Vertica. \n\nReferences:\n\nCVE-2014-6271\nCVE-2014-6277\nCVE-2014-6278\nCVE-2014-7169\nCVE-2014-7186\nCVE-2014-7187\nSSRT101827\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \n\nHP Vertica AMI\u0027s and Virtual Machines prior to v7.1.1-0. \n\nCVSS 2.0 Base Metrics\n===========================================================\n  Reference              Base Vector             Base Score\nCVE-2014-6271    (AV:N/AC:L/Au:N/C:C/I:C/A:C)       10.0\nCVE-2104-6277    (AV:N/AC:L/Au:N/C:C/I:C/A:C)       10.0\nCVE-2104-6278    (AV:N/AC:L/Au:N/C:C/I:C/A:C)       10.0\nCVE-2014-7169    (AV:N/AC:L/Au:N/C:C/I:C/A:C)       10.0\nCVE-2014-7186    (AV:N/AC:L/Au:N/C:C/I:C/A:C)       10.0\nCVE-2014-7187    (AV:N/AC:L/Au:N/C:C/I:C/A:C)       10.0\n===========================================================\n             Information on CVSS is documented\n            in HP Customer Notice: HPSN-2008-002\n\nRESOLUTION\n\nWe recommend installing Vertica v7.1.1-0 or subsequent, or manually\ninstalling a new version of Bash, such as Bash43-027. \n\nHP has released the following updates to resolve this vulnerability for HP\nVertica products. \n\nUpdate to the latest VM image available at: https://my.vertica.com\n\nFor customers using the AMI version HP Vertica Analytics platform, please\ninstall the latest image available at Amazon. \n\nReport: To report a potential security vulnerability with any HP supported\nproduct, send Email to: security-alert@hp.com\nIt is strongly recommended that security related information being\ncommunicated to HP be encrypted using PGP, especially exploit information. \nTo get the security-alert PGP key, please send an e-mail message as follows:\n  To: security-alert@hp.com\n  Subject: get key\n\nSubscribe: To initiate a subscription to receive future HP Security Bulletins\nvia Email:\nhttp://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA\u0026langcode=USENG\n\u0026jumpid=in_SC-GEN__driverITRC\u0026topiccode=ITRC\nOn the web page: ITRC security bulletins and patch sign-up\nUnder Step1: your ITRC security bulletins and patches\n  - check ALL categories for which alerts are required and continue. \nUnder Step2: your ITRC operating systems\n  - verify your operating system selections are checked and save. \n\nTo update an existing subscription: http://h30046.www3.hp.com/subSignIn.php\nLog in on the web page: Subscriber\u0027s choice for Business: sign-in. \nOn the web page: Subscriber\u0027s Choice: your profile summary - use Edit Profile\nto update appropriate sections. \n\nTo review previously published Security Bulletins visit:\nhttp://www.itrc.hp.com/service/cki/secBullArchive.do\n\n* The Software Product Category that this Security Bulletin relates to is\nrepresented by the 5th and 6th characters of the Bulletin number in the\ntitle: GN = HP General SW\n MA = HP Management Agents\n MI = Misc. 3rd Party SW\n\nMP = HP MPE/iX\n NS = HP NonStop Servers\n OV = HP OpenVMS\n\nPI = HP Printing \u0026 Imaging\n ST = HP Storage SW\n TL = HP Trusted Linux\n\nTU = HP Tru64 UNIX\n UX = HP-UX\n VV = HP VirtualVault\n\nSystem management and security procedures must be reviewed frequently to\nmaintain system integrity. HP is continually reviewing and enhancing the\nsecurity features of software products to provide customers with current\nsecure solutions. \n\n\"HP is broadly distributing this Security Bulletin in order to bring to the\nattention of users of the affected HP products the important security\ninformation contained in this Bulletin. HP recommends that all users\ndetermine the applicability of this information to their individual\nsituations and take appropriate action. HP does not warrant that this\ninformation is necessarily accurate or complete for all user situations and,\nconsequently, HP will not be responsible for any damages resulting from\nuser\u0027s use or disregard of the information provided in this Bulletin. To the\nextent permitted by law, HP disclaims all warranties, either express or\nimplied, including the warranties of merchantability and fitness for a\nparticular purpose, title and non-infringement.\"\n\nCopyright 2014 Hewlett-Packard Development Company, L.P. \n\nHewlett-Packard Company shall not be liable for technical or editorial errors\nor omissions contained herein. The information provided is provided \"as is\"\nwithout warranty of any kind. To the extent permitted by law, neither HP or\nits affiliates, subcontractors or suppliers will be liable for incidental,\nspecial or consequential damages including downtime cost; lost profits;\ndamages relating to the procurement of substitute products or services; or\ndamages for loss of data, or software restoration. The information in this\ndocument is subject to change without notice. \n\n  Note: HP and the switch vendor recommend running an active version of\nFabric OS (FOS) listed on the HP Single Point of Connectivity Knowledge\n(SPOCK) website ( http://h20272.www2.hp.com/ ) and applying the work-around\ninformation provided in the MITIGATION INFORMATION section below to protect\nHP StoreFabric B-series switches from this vulnerability. \n    - Utilize FOS password policy management to strengthen the complexity,\nage, and history requirements of switch account passwords",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-6278"
      },
      {
        "db": "CERT/CC",
        "id": "VU#252743"
      },
      {
        "db": "BID",
        "id": "70166"
      },
      {
        "db": "PACKETSTORM",
        "id": "128764"
      },
      {
        "db": "PACKETSTORM",
        "id": "128606"
      },
      {
        "db": "PACKETSTORM",
        "id": "130988"
      },
      {
        "db": "PACKETSTORM",
        "id": "128567"
      },
      {
        "db": "PACKETSTORM",
        "id": "129068"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-6278"
      },
      {
        "db": "PACKETSTORM",
        "id": "128864"
      },
      {
        "db": "PACKETSTORM",
        "id": "128752"
      },
      {
        "db": "PACKETSTORM",
        "id": "129438"
      },
      {
        "db": "PACKETSTORM",
        "id": "129095"
      },
      {
        "db": "PACKETSTORM",
        "id": "129073"
      },
      {
        "db": "PACKETSTORM",
        "id": "129617"
      },
      {
        "db": "PACKETSTORM",
        "id": "128760"
      },
      {
        "db": "PACKETSTORM",
        "id": "129070"
      }
    ],
    "trust": 3.15
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=39568",
        "trust": 0.5,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-6278"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-6278",
        "trust": 2.7
      },
      {
        "db": "MCAFEE",
        "id": "SB10085",
        "trust": 1.4
      },
      {
        "db": "JUNIPER",
        "id": "JSA10648",
        "trust": 1.4
      },
      {
        "db": "PACKETSTORM",
        "id": "128567",
        "trust": 1.2
      },
      {
        "db": "CERT/CC",
        "id": "VU#252743",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61641",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61603",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61287",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "60055",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61654",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61313",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "60044",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "58200",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61550",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61780",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61552",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61565",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61312",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "60193",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61129",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61703",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "60433",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61128",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "60063",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61816",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61633",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "60034",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61643",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61485",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61503",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "62343",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "60325",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61291",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61328",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61283",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "60024",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61442",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "59961",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61471",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61857",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "61065",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "59907",
        "trust": 1.1
      },
      {
        "db": "SECUNIA",
        "id": "62312",
        "trust": 1.1
      },
      {
        "db": "PACKETSTORM",
        "id": "137344",
        "trust": 1.1
      },
      {
        "db": "JVN",
        "id": "JVN55667175",
        "trust": 1.1
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-000126",
        "trust": 1.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "39887",
        "trust": 1.0
      },
      {
        "db": "EXPLOIT-DB",
        "id": "39568",
        "trust": 1.0
      },
      {
        "db": "BID",
        "id": "70166",
        "trust": 0.4
      },
      {
        "db": "JUNIPER",
        "id": "JSA10661",
        "trust": 0.3
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-14-269-01",
        "trust": 0.3
      },
      {
        "db": "EXPLOITDB",
        "id": "39568",
        "trust": 0.1
      },
      {
        "db": "EXPLOITDB",
        "id": "39887",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-6278",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "128764",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "128606",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "130988",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "129068",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "129070",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "128864",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "128752",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "129438",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "129095",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "129073",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "129617",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "128760",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#252743"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-6278"
      },
      {
        "db": "BID",
        "id": "70166"
      },
      {
        "db": "PACKETSTORM",
        "id": "128764"
      },
      {
        "db": "PACKETSTORM",
        "id": "128606"
      },
      {
        "db": "PACKETSTORM",
        "id": "130988"
      },
      {
        "db": "PACKETSTORM",
        "id": "128567"
      },
      {
        "db": "PACKETSTORM",
        "id": "129068"
      },
      {
        "db": "PACKETSTORM",
        "id": "129070"
      },
      {
        "db": "PACKETSTORM",
        "id": "128864"
      },
      {
        "db": "PACKETSTORM",
        "id": "128752"
      },
      {
        "db": "PACKETSTORM",
        "id": "129438"
      },
      {
        "db": "PACKETSTORM",
        "id": "129095"
      },
      {
        "db": "PACKETSTORM",
        "id": "129073"
      },
      {
        "db": "PACKETSTORM",
        "id": "129617"
      },
      {
        "db": "PACKETSTORM",
        "id": "128760"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-6278"
      }
    ]
  },
  "id": "VAR-201409-1154",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.3212341
  },
  "last_update_date": "2024-11-29T19:29:14.894000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Ubuntu Security Notice: bash vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-2380-1"
      },
      {
        "title": "VMware Security Advisories: VMware product updates address critical Bash security vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=vmware_security_advisories\u0026qid=86cb6b3955e100fdc9667a7ca916c772"
      },
      {
        "title": "Symantec Security Advisories: SA82 : GNU Bash Shellshock Command Injection Vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories\u0026qid=2b57ceaadfde2a8b03482273e1fd21ea"
      },
      {
        "title": "Citrix Security Bulletins: Citrix XenServer Shellshock Security Update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=citrix_security_bulletins\u0026qid=64ae0aae8269062686789e3a3fa1d2bf"
      },
      {
        "title": "Tenable Security Advisories: [R7] Tenable Appliance Affected by GNU bash \u0027Shellshock\u0027 Vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=tenable_security_advisories\u0026qid=TNS-2014-07"
      },
      {
        "title": "Citrix Security Bulletins: Citrix Security Advisory for GNU Bash Shellshock Vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=citrix_security_bulletins\u0026qid=73443a6db89dc66fc6bcb49f85bfd1ab"
      },
      {
        "title": "CiscoUCS-Shellshock",
        "trust": 0.1,
        "url": "https://github.com/thatchriseckert/CiscoUCS-Shellshock "
      },
      {
        "title": "0day-WriteUp-TryHackme-CTF-Medium",
        "trust": 0.1,
        "url": "https://github.com/elc4br4/0day-WriteUp-TryHackme-CTF-Medium "
      },
      {
        "title": "ShellScan",
        "trust": 0.1,
        "url": "https://github.com/0xICF/ShellScan "
      },
      {
        "title": "cvesploit",
        "trust": 0.1,
        "url": "https://github.com/swapravo/cvesploit "
      },
      {
        "title": "fabric-shellshock",
        "trust": 0.1,
        "url": "https://github.com/ericlake/fabric-shellshock "
      },
      {
        "title": "w-test",
        "trust": 0.1,
        "url": "https://github.com/inspirion87/w-test "
      },
      {
        "title": "Xpl-SHELLSHOCK-Ch3ck",
        "trust": 0.1,
        "url": "https://github.com/googleinurl/Xpl-SHELLSHOCK-Ch3ck "
      },
      {
        "title": "bashcheck",
        "trust": 0.1,
        "url": "https://github.com/hannob/bashcheck "
      },
      {
        "title": "shellshockFixOSX",
        "trust": 0.1,
        "url": "https://github.com/opragel/shellshockFixOSX "
      },
      {
        "title": "shocktrooper",
        "trust": 0.1,
        "url": "https://github.com/EvanK/shocktrooper "
      },
      {
        "title": "ShellShockHunter",
        "trust": 0.1,
        "url": "https://github.com/MrCl0wnLab/ShellShockHunter "
      },
      {
        "title": "shellshocker-pocs",
        "trust": 0.1,
        "url": "https://github.com/mubix/shellshocker-pocs "
      },
      {
        "title": "ActiveScanPlusPlus",
        "trust": 0.1,
        "url": "https://github.com/albinowax/ActiveScanPlusPlus "
      },
      {
        "title": "afl-cve",
        "trust": 0.1,
        "url": "https://github.com/mrash/afl-cve "
      },
      {
        "title": "Threatpost",
        "trust": 0.1,
        "url": "https://threatpost.com/researcher-takes-wraps-off-two-undisclosed-shellshock-vulnerabilities-in-bash/108674/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-6278"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-78",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-6278"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.2,
        "url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20140926-bash"
      },
      {
        "trust": 2.2,
        "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10085"
      },
      {
        "trust": 1.9,
        "url": "http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html"
      },
      {
        "trust": 1.9,
        "url": "https://kb.bluecoat.com/index?page=content\u0026id=sa82"
      },
      {
        "trust": 1.9,
        "url": "https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html"
      },
      {
        "trust": 1.6,
        "url": "https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21685749"
      },
      {
        "trust": 1.4,
        "url": "http://www.vmware.com/security/advisories/vmsa-2014-0010.html"
      },
      {
        "trust": 1.4,
        "url": "https://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10648"
      },
      {
        "trust": 1.4,
        "url": "http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21685914"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3t1021272"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004898"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3t1021279"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004897"
      },
      {
        "trust": 1.4,
        "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5096315"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004915"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21685604"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21686131"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21686246"
      },
      {
        "trust": 1.4,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21687079"
      },
      {
        "trust": 1.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-6277"
      },
      {
        "trust": 1.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-6278"
      },
      {
        "trust": 1.2,
        "url": "http://www.ubuntu.com/usn/usn-2380-1"
      },
      {
        "trust": 1.2,
        "url": "https://www.exploit-db.com/exploits/39568/"
      },
      {
        "trust": 1.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-7169"
      },
      {
        "trust": 1.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-6271"
      },
      {
        "trust": 1.1,
        "url": "http://www.fortiguard.com/advisory/fg-ir-14-030/"
      },
      {
        "trust": 1.1,
        "url": "https://security-tracker.debian.org/tracker/cve-2014-6278"
      },
      {
        "trust": 1.1,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1147414"
      },
      {
        "trust": 1.1,
        "url": "https://www.suse.com/support/shellshock/"
      },
      {
        "trust": 1.1,
        "url": "http://support.novell.com/security/cve/cve-2014-6278.html"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61641"
      },
      {
        "trust": 1.1,
        "url": "http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61485"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59907"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61654"
      },
      {
        "trust": 1.1,
        "url": "http://packetstormsecurity.com/files/128567/ca-technologies-gnu-bash-shellshock.html"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61565"
      },
      {
        "trust": 1.1,
        "url": "http://www.novell.com/support/kb/doc.php?id=7015721"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61643"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61503"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61633"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61552"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61703"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61283"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61603"
      },
      {
        "trust": 1.1,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00004.html"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141330468527613\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141345648114150\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "https://support.citrix.com/article/ctx200217"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004879"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/60034"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61816"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61128"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61313"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21685733"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61442"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61287"
      },
      {
        "trust": 1.1,
        "url": "https://support.citrix.com/article/ctx200223"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/60055"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61129"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61780"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21686479"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21685541"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61471"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/58200"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61328"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61857"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/60193"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61065"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61550"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/60325"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61312"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21686494"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/60063"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/61291"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/60044"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21686445"
      },
      {
        "trust": 1.1,
        "url": "https://supportcenter.checkpoint.com/supportcenter/portal?eventsubmit_dogoviewsolutiondetails=\u0026solutionid=sk102673\u0026src=securityalerts"
      },
      {
        "trust": 1.1,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3t1021361"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/60433"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/60024"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141383353622268\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141383304022067\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141383244821813\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141450491804793\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://jvn.jp/en/jp/jvn55667175/index.html"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141383081521087\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://www.qnap.com/i/en/support/con_show.php?cid=61"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141383026420882\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://jvndb.jvn.jp/jvndb/jvndb-2014-000126"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141383196021590\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141383465822787\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141577137423233\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141577241923505\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141576728022234\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141577297623641\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141585637922673\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/62312"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/59961"
      },
      {
        "trust": 1.1,
        "url": "http://secunia.com/advisories/62343"
      },
      {
        "trust": 1.1,
        "url": "http://linux.oracle.com/errata/elsa-2014-3093"
      },
      {
        "trust": 1.1,
        "url": "http://linux.oracle.com/errata/elsa-2014-3094"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=142358026505815\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=142358078406056\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=141879528318582\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=142118135300698\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://marc.info/?l=bugtraq\u0026m=142721162228379\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://www.mandriva.com/security/advisories?name=mdvsa-2015:164"
      },
      {
        "trust": 1.1,
        "url": "http://packetstormsecurity.com/files/137344/sun-secure-global-desktop-oracle-global-desktop-shellshock.html"
      },
      {
        "trust": 1.1,
        "url": "https://www.exploit-db.com/exploits/39887/"
      },
      {
        "trust": 1.1,
        "url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-c04518183"
      },
      {
        "trust": 1.1,
        "url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-c04497075"
      },
      {
        "trust": 1.1,
        "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1008-security-advisory-0006"
      },
      {
        "trust": 1.1,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/"
      },
      {
        "trust": 1.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-7186"
      },
      {
        "trust": 1.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-7187"
      },
      {
        "trust": 1.0,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/"
      },
      {
        "trust": 1.0,
        "url": "http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins"
      },
      {
        "trust": 0.8,
        "url": "http://seclists.org/oss-sec/2014/q3/650"
      },
      {
        "trust": 0.8,
        "url": "https://access.redhat.com/articles/1200223"
      },
      {
        "trust": 0.8,
        "url": "http://seclists.org/oss-sec/2014/q3/688"
      },
      {
        "trust": 0.8,
        "url": "http://seclists.org/oss-sec/2014/q3/685"
      },
      {
        "trust": 0.8,
        "url": "http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html"
      },
      {
        "trust": 0.8,
        "url": "https://gist.github.com/anonymous/929d622f3b36b00c0be1"
      },
      {
        "trust": 0.8,
        "url": "https://www.dfranke.us/posts/2014-09-27-shell-shock-exploitation-vectors.html"
      },
      {
        "trust": 0.8,
        "url": "https://shellshocker.net/#"
      },
      {
        "trust": 0.8,
        "url": "http://support.apple.com/kb/ht6495"
      },
      {
        "trust": 0.8,
        "url": "https://www.barracuda.com/support/techalerts"
      },
      {
        "trust": 0.8,
        "url": "http://www.checkpoint.com/blog/protecting-shellshock/index.html"
      },
      {
        "trust": 0.8,
        "url": "http://securityadvisories.dlink.com/security/publication.aspx?name=sap10044"
      },
      {
        "trust": 0.8,
        "url": "https://www.debian.org/security/2014/dsa-3032"
      },
      {
        "trust": 0.8,
        "url": "http://learn.extremenetworks.com/rs/extreme/images/vn-2014-001-%20gnu%20bash%20threats%20-cve-2014-7169%20rev01.pdf"
      },
      {
        "trust": 0.8,
        "url": "http://fedoramagazine.org/shellshock-update-bash-packages-that-resolve-cve-2014-6271-and-cve-2014-7169-available/"
      },
      {
        "trust": 0.8,
        "url": "http://www.gentoo.org/security/en/glsa/glsa-201409-09.xml"
      },
      {
        "trust": 0.8,
        "url": "http://alerts.hp.com/r?2.1.3kt.2zr.15ee22.l8mgqe..n.ghvs.8f9a.bw89mq%5f%5fdbosfqk0"
      },
      {
        "trust": 0.8,
        "url": "http://kb.juniper.net/jsa10648"
      },
      {
        "trust": 0.8,
        "url": "http://jpn.nec.com/security-info/av14-003.html"
      },
      {
        "trust": 0.8,
        "url": "http://support.novell.com/security/cve/cve-2014-6271.html"
      },
      {
        "trust": 0.8,
        "url": "https://www.suse.com/support/kb/doc.php?id=7015702"
      },
      {
        "trust": 0.8,
        "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2014\u0026m=slackware-security.522193"
      },
      {
        "trust": 0.8,
        "url": "http://www.ubuntu.com/usn/usn-2362-1/"
      },
      {
        "trust": 0.8,
        "url": "http://kb.vmware.com/selfservice/microsites/search.do?language=en_us\u0026cmd=displaykc\u0026externalid=2090740"
      },
      {
        "trust": 0.8,
        "url": "http://pkgsrc.se/files.php?messageid=20140925202832.9ad9c98@cvs.netbsd.org"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2104-6277"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2104-6278"
      },
      {
        "trust": 0.3,
        "url": "http://lcamtuf.blogspot.de/2014/09/bash-bug-apply-unofficial-patch-now.html"
      },
      {
        "trust": 0.3,
        "url": "http://www.gnu.org/software/bash/"
      },
      {
        "trust": 0.3,
        "url": "https://lists.gnu.org/archive/html/bug-bash/2014-10/msg00040.html"
      },
      {
        "trust": 0.3,
        "url": "https://supportcenter.checkpoint.com/supportcenter/portal?eventsubmit_dogoviewsolutiondetails=\u0026solutionid=sk102673"
      },
      {
        "trust": 0.3,
        "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=kb83017"
      },
      {
        "trust": 0.3,
        "url": "https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_bash"
      },
      {
        "trust": 0.3,
        "url": "http://lcamtuf.blogspot.in/2014/09/quick-notes-about-bash-bug-its-impact.html"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/connections/blogs/psirt/entry/security_bulletin_vulnerabilities_in_bash_affect_certain_qlogic_products_that_ibm_resells_for_bladecenter_and_flex_system_products_cve_2014_6271_c"
      },
      {
        "trust": 0.3,
        "url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-notices/archive/hw-372538.htm"
      },
      {
        "trust": 0.3,
        "url": "http://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html?ref=rss"
      },
      {
        "trust": 0.3,
        "url": "http://www.ibm.com/support/docview.wss?uid=ssg1s1004932"
      },
      {
        "trust": 0.3,
        "url": "http://www.ibm.com/support/docview.wss?uid=swg21686433"
      },
      {
        "trust": 0.3,
        "url": "http://www.ibm.com/support/docview.wss?uid=isg3t1021361"
      },
      {
        "trust": 0.3,
        "url": "http://www.ibm.com/support/docview.wss?uid=swg21686494"
      },
      {
        "trust": 0.3,
        "url": "http://www.ibm.com/support/docview.wss?uid=swg21686445"
      },
      {
        "trust": 0.3,
        "url": "http://www.ibm.com/support/docview.wss?uid=ssg1s1004903"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004928"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004911"
      },
      {
        "trust": 0.3,
        "url": "http://www.ibm.com/support/docview.wss?uid=swg21686479"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04497075"
      },
      {
        "trust": 0.3,
        "url": "http://seclists.org/fulldisclosure/2014/oct/25"
      },
      {
        "trust": 0.3,
        "url": "http://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10661\u0026cat=sirt_1\u0026actp=list"
      },
      {
        "trust": 0.3,
        "url": "https://downloads.avaya.com/css/p8/documents/100183172"
      },
      {
        "trust": 0.3,
        "url": "https://ics-cert.us-cert.gov/advisories/supplement-icsa-14-269-01"
      },
      {
        "trust": 0.3,
        "url": "http://www.kb.cert.org/vuls/id/bluu-9paps5"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04479398"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04479402"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04479601"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04479505"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04479492"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04475942"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04471532"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04488200"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04478866"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04479536"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04540692"
      },
      {
        "trust": 0.3,
        "url": "http://h20564.www2.hp.com/hpsc/doc/public/display?docid=emr_na-c04561445"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04471546"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04471538"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/hpsc/doc/public/display?docid=emr_na-c04497042"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/hpsc/doc/public/display?docid=emr_na-c04512907 "
      },
      {
        "trust": 0.3,
        "url": "http://seclists.org/bugtraq/2015/feb/76"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/hpsc/doc/public/display?docid=emr_na-c04558068"
      },
      {
        "trust": 0.3,
        "url": "http://seclists.org/bugtraq/2015/feb/77"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04487558"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04487573"
      },
      {
        "trust": 0.3,
        "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04496383"
      },
      {
        "trust": 0.3,
        "url": "http://www.kb.cert.org/vuls/id/bluu-9paptm"
      },
      {
        "trust": 0.3,
        "url": "http://www.kb.cert.org/vuls/id/bluu-9paptz"
      },
      {
        "trust": 0.3,
        "url": "https://www.xerox.com/download/security/security-bulletin/1a2e5-5116a33c2fb27/cert_security_mini-_bulletin_xrx15k_for_77xx_r15-03_v1.0.pdf"
      },
      {
        "trust": 0.3,
        "url": "https://www.xerox.com/download/security/security-bulletin/2b8d8-513128526dd97/cert_security_mini-_bulletin_xrx15m_for_wc75xx_v1_1.pdf"
      },
      {
        "trust": 0.3,
        "url": "https://www.xerox.com/download/security/security-bulletin/2eeef-51056e459c6d8/cert_security_mini-_bulletin_xrx15h_for_p7800_v1_0.pdf"
      },
      {
        "trust": 0.3,
        "url": "https://www.xerox.com/download/security/security-bulletin/2a20e-5105457a515cc/cert_security_mini-_bulletin_xrx15e_for_wc57xx_v1_0.pdf"
      },
      {
        "trust": 0.3,
        "url": "https://www.xerox.com/download/security/security-bulletin/2a901-510567b876a35/cert_security_mini-_bulletin_xrx15g_for_p6700_v1_0.pdf"
      },
      {
        "trust": 0.3,
        "url": "https://www.xerox.com/download/security/security-bulletin/29a7e-50e49f9c009f9/cert_security_mini_bulletin_xrx14g_for_77xx_v1.1.pdf"
      },
      {
        "trust": 0.3,
        "url": "https://www.xerox.com/download/security/security-bulletin/1a7a1-50f12e334b734/cert_security_mini-_bulletin_xrx14h_for_wc59xx_v1.pdf"
      },
      {
        "trust": 0.3,
        "url": "https://www.xerox.com/download/security/security-bulletin/2df3c-51055b159fd50/cert_security_mini_bulletin_xrx15f_for_connectkey_1.5_v1-01.pdf"
      },
      {
        "trust": 0.3,
        "url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/archive/hw-377648.htm"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=ssg1s1004982"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=ssg1s1004879"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21685873"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21686132"
      },
      {
        "trust": 0.3,
        "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5096533"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21686024"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21686037"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21685733"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21686171"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21686098"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21685875"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=nas8n1020272"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21685541"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=ssg1s1004905"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21685673"
      },
      {
        "trust": 0.3,
        "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21685837"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21687971"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21685691"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004933"
      },
      {
        "trust": 0.3,
        "url": "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5096503"
      },
      {
        "trust": 0.3,
        "url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004945"
      },
      {
        "trust": 0.3,
        "url": "https://downloads.avaya.com/css/p8/documents/100183088"
      },
      {
        "trust": 0.2,
        "url": "https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetsea"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/78.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.securityfocus.com/bid/70166"
      },
      {
        "trust": 0.1,
        "url": "http://tools.cisco.com/security/center/viewalert.x?alertid=35880"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/2380-1/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0224"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/bash/4.2-2ubuntu2.6"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.5"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/bash/4.1-2ubuntu3.5"
      },
      {
        "trust": 0.1,
        "url": "https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse"
      },
      {
        "trust": 0.1,
        "url": "https://www.ca.com"
      },
      {
        "trust": 0.1,
        "url": "https://support.ca.com/irj/portal/anonymous/phpsbpldgpg"
      },
      {
        "trust": 0.1,
        "url": "https://support.ca.com."
      },
      {
        "trust": 0.1,
        "url": "http://h30046.www3.hp.com/driveralertprofile.php?regioncode=na\u0026langcode=useng"
      },
      {
        "trust": 0.1,
        "url": "http://www.itrc.hp.com/service/cki/secbullarchive.do"
      },
      {
        "trust": 0.1,
        "url": "https://my.vertica.com"
      },
      {
        "trust": 0.1,
        "url": "http://h30046.www3.hp.com/subsignin.php"
      },
      {
        "trust": 0.1,
        "url": "http://h20272.www2.hp.com/"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#252743"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-6278"
      },
      {
        "db": "BID",
        "id": "70166"
      },
      {
        "db": "PACKETSTORM",
        "id": "128764"
      },
      {
        "db": "PACKETSTORM",
        "id": "128606"
      },
      {
        "db": "PACKETSTORM",
        "id": "130988"
      },
      {
        "db": "PACKETSTORM",
        "id": "128567"
      },
      {
        "db": "PACKETSTORM",
        "id": "129068"
      },
      {
        "db": "PACKETSTORM",
        "id": "129070"
      },
      {
        "db": "PACKETSTORM",
        "id": "128864"
      },
      {
        "db": "PACKETSTORM",
        "id": "128752"
      },
      {
        "db": "PACKETSTORM",
        "id": "129438"
      },
      {
        "db": "PACKETSTORM",
        "id": "129095"
      },
      {
        "db": "PACKETSTORM",
        "id": "129073"
      },
      {
        "db": "PACKETSTORM",
        "id": "129617"
      },
      {
        "db": "PACKETSTORM",
        "id": "128760"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-6278"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#252743"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-6278"
      },
      {
        "db": "BID",
        "id": "70166"
      },
      {
        "db": "PACKETSTORM",
        "id": "128764"
      },
      {
        "db": "PACKETSTORM",
        "id": "128606"
      },
      {
        "db": "PACKETSTORM",
        "id": "130988"
      },
      {
        "db": "PACKETSTORM",
        "id": "128567"
      },
      {
        "db": "PACKETSTORM",
        "id": "129068"
      },
      {
        "db": "PACKETSTORM",
        "id": "129070"
      },
      {
        "db": "PACKETSTORM",
        "id": "128864"
      },
      {
        "db": "PACKETSTORM",
        "id": "128752"
      },
      {
        "db": "PACKETSTORM",
        "id": "129438"
      },
      {
        "db": "PACKETSTORM",
        "id": "129095"
      },
      {
        "db": "PACKETSTORM",
        "id": "129073"
      },
      {
        "db": "PACKETSTORM",
        "id": "129617"
      },
      {
        "db": "PACKETSTORM",
        "id": "128760"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-6278"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-09-25T00:00:00",
        "db": "CERT/CC",
        "id": "VU#252743"
      },
      {
        "date": "2014-09-30T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-6278"
      },
      {
        "date": "2014-09-27T00:00:00",
        "db": "BID",
        "id": "70166"
      },
      {
        "date": "2014-10-20T17:57:00",
        "db": "PACKETSTORM",
        "id": "128764"
      },
      {
        "date": "2014-10-09T23:44:16",
        "db": "PACKETSTORM",
        "id": "128606"
      },
      {
        "date": "2015-03-24T17:07:02",
        "db": "PACKETSTORM",
        "id": "130988"
      },
      {
        "date": "2014-10-06T16:47:01",
        "db": "PACKETSTORM",
        "id": "128567"
      },
      {
        "date": "2014-11-12T18:13:39",
        "db": "PACKETSTORM",
        "id": "129068"
      },
      {
        "date": "2014-11-12T18:13:53",
        "db": "PACKETSTORM",
        "id": "129070"
      },
      {
        "date": "2014-10-27T23:44:00",
        "db": "PACKETSTORM",
        "id": "128864"
      },
      {
        "date": "2014-10-20T13:14:00",
        "db": "PACKETSTORM",
        "id": "128752"
      },
      {
        "date": "2014-12-09T23:15:30",
        "db": "PACKETSTORM",
        "id": "129438"
      },
      {
        "date": "2014-11-13T17:15:31",
        "db": "PACKETSTORM",
        "id": "129095"
      },
      {
        "date": "2014-11-12T18:14:19",
        "db": "PACKETSTORM",
        "id": "129073"
      },
      {
        "date": "2014-12-17T18:27:35",
        "db": "PACKETSTORM",
        "id": "129617"
      },
      {
        "date": "2014-10-20T17:03:00",
        "db": "PACKETSTORM",
        "id": "128760"
      },
      {
        "date": "2014-09-30T10:55:04.723000",
        "db": "NVD",
        "id": "CVE-2014-6278"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-04-14T00:00:00",
        "db": "CERT/CC",
        "id": "VU#252743"
      },
      {
        "date": "2021-11-17T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-6278"
      },
      {
        "date": "2016-07-05T21:53:00",
        "db": "BID",
        "id": "70166"
      },
      {
        "date": "2024-11-21T02:14:05.110000",
        "db": "NVD",
        "id": "CVE-2014-6278"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "70166"
      }
    ],
    "trust": 0.3
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "GNU Bash shell executes commands in exported functions in environment variables",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#252743"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Design Error",
    "sources": [
      {
        "db": "BID",
        "id": "70166"
      }
    ],
    "trust": 0.3
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.